China-nexus operational relay box networks rotate their egress IPs monthly and pick exit nodes inside the victim’s own region. Blocklists and impossible-travel rules don’t fire. Here’s where the detection actually lives, and what the first round of tuning has to fix.
Z.ai’s GLM-5.2 is a cheap, MIT-licensed, long-horizon coding agent anyone can self-host with no provider-side refusal, logging, or kill switch. Paired with fresh AISI research on autonomous container-sandbox escape, the lesson is blunt: the model was never your control point. Your runtime hardening is.
An out-of-bounds read in Ollama’s model quantization path leaks process heap, and the data leaves through Ollama’s own /api/push. The detection problem isn’t the read, it’s that the box almost certainly isn’t logging anything.
Indirect prompt injection is hard to catch in the prompt and easy to miss in the model output. The reliable detection surface is the outbound fetch the rendered answer triggers — here is how to instrument it and where the false positives come from.
Nation-state operators now rent disposable relay meshes that cycle IPs faster than your threat feed updates. Indicator-based blocking was already brittle; against ORB networks it’s mostly theater. Here’s what actually moves the needle.
CVE-2026-49975 chains the 2016 HPACK Bomb with an HTTP/2 flow-control stall into a remote, unauthenticated memory-exhaustion DoS that takes down default nginx, Apache, IIS, Envoy, and Pingora configs from a single home connection. An OpenAI Codex agent found it by reading the code.
A CVSS 9.8 stack-based buffer overflow in Windows Netlogon gives an unauthenticated attacker code execution on a domain controller. Microsoft called exploitation ‘less likely.’ Belgium’s CCB says it’s happening now.
CVE-2026-42897 is an actively exploited OWA cross-site-scripting flaw in Microsoft Exchange Server 2016, 2019, and Subscription Edition. CVSS 8.1, KEV-listed, federal remediation deadline May 29. A specially crafted email runs JavaScript in the victim’s OWA session — session token theft, mailbox read, send-as, mailbox rules — and the catch buried in Microsoft’s guidance is that a permanent patch is gated behind Period 2 ESU enrollment for everyone still on 2016 or 2019. The EEMS mitigation works, with caveats. Here’s what’s real about it.
A defender-oriented look at where HTTP/2-to-HTTP/1.1 request smuggling sits in 2026 — the parser-differential class that keeps finding new homes, what the detection actually looks like in Splunk, and what most teams miss on the first tuning pass.
Chaotic Eclipse dropped two unpatched Windows zero-days on May 13, 2026. YellowKey turns an NTFS transaction log on a USB stick into a BitLocker bypass through WinRE — physical access, no recovery key, no PIN required on TPM-only boxes. GreenPlasma is the companion privilege escalation through CTFMON. No CVEs, no patches, and a researcher who has promised more for June’s Patch Tuesday.
